Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/01/2025, 17:39
Static task
static1
Behavioral task
behavioral1
Sample
9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe
Resource
win7-20240903-en
General
-
Target
9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe
-
Size
708KB
-
MD5
72aab2ac97092702e3e5804e18306a50
-
SHA1
080a4b05d7b760b97aca390ae818db83b02ad14b
-
SHA256
9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61da
-
SHA512
e1fcfe79903d292a21b1b7af9718bed828cab51accb499991db444e9eee205269dc58d26eae20cd9e416a23c261d8bd17d9b5b515be24421178bce8d1ddc0600
-
SSDEEP
12288:OrzFejO/H4b3toyhFHKYpJ8fKLpl5k4DbF53e0IUFLLC6GQG8:OlAOvOoyhAYpJkip
Malware Config
Extracted
formbook
4.1
mynd
bbluedot3dwdbuy.com
aucworks.com
seekselflove.com
thebrandolphcollection.com
saint-daniel.info
covidtestcharleston.com
buniy.com
welprosol.com
focusedbusinesspartners.com
ichikawa.ltd
nieght.com
beediecandleco.com
gracobby.com
nowipe.club
meherconsultancy.com
didonghanquocxachtay.online
snovythailand.com
onetimecreditscore.net
hayosiapa.com
dumpstersforsellers.com
kopfimtopf.com
churchofmanifestation.com
scoopeer.com
givrees.com
giftmystyle.com
enovadis.com
blackcreativeslab.com
juamd.com
yaktaichicks.com
tamquin.net
themaskedstitcher.com
puresed.com
magadir.com
hiptopip.com
surgicalcaseoa.com
yanrk-ht586c.com
online-us.online
salonsuitesofcharleston.com
treeremovalcocoa.com
thewhiskeydisco.com
speaknativechinese.com
e-nokutan.com
mantra613.com
flatrenovation.site
servingdivisiion.com
jemimabdebrito.com
patrington-healthandfitness.com
pandemiyardimbildirim-tr.com
espejitia.com
natasciaedera.com
allcostpk.com
r10288.com
sabzi.uk
astitchinthyme.com
uniq-logistic.online
refreshingtherapy.com
pppdebtrisk.com
jejucash.net
ftfss.com
saintesproe.com
zfcarwholesalers.com
raben-p.site
sundaymorning.media
gatezless.com
dtcu0ng.com
Signatures
-
Formbook family
-
Formbook payload 2 IoCs
resource yara_rule behavioral1/memory/2632-19-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/2632-23-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1260 set thread context of 2632 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 32 PID 2632 set thread context of 1192 2632 RegSvcs.exe 21 PID 2248 set thread context of 1192 2248 systray.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2756 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 2632 RegSvcs.exe 2632 RegSvcs.exe 2248 systray.exe 2248 systray.exe 2248 systray.exe 2248 systray.exe 2248 systray.exe 2248 systray.exe 2248 systray.exe 2248 systray.exe 2248 systray.exe 2248 systray.exe 2248 systray.exe 2248 systray.exe 2248 systray.exe 2248 systray.exe 2248 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2632 RegSvcs.exe 2632 RegSvcs.exe 2632 RegSvcs.exe 2248 systray.exe 2248 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe Token: SeDebugPrivilege 2632 RegSvcs.exe Token: SeDebugPrivilege 2248 systray.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1260 wrote to memory of 2756 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 31 PID 1260 wrote to memory of 2756 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 31 PID 1260 wrote to memory of 2756 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 31 PID 1260 wrote to memory of 2756 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 31 PID 1260 wrote to memory of 2632 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 32 PID 1260 wrote to memory of 2632 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 32 PID 1260 wrote to memory of 2632 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 32 PID 1260 wrote to memory of 2632 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 32 PID 1260 wrote to memory of 2632 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 32 PID 1260 wrote to memory of 2632 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 32 PID 1260 wrote to memory of 2632 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 32 PID 1260 wrote to memory of 2632 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 32 PID 1260 wrote to memory of 2632 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 32 PID 1260 wrote to memory of 2632 1260 9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe 32 PID 1192 wrote to memory of 2248 1192 Explorer.EXE 40 PID 1192 wrote to memory of 2248 1192 Explorer.EXE 40 PID 1192 wrote to memory of 2248 1192 Explorer.EXE 40 PID 1192 wrote to memory of 2248 1192 Explorer.EXE 40 PID 2248 wrote to memory of 660 2248 systray.exe 41 PID 2248 wrote to memory of 660 2248 systray.exe 41 PID 2248 wrote to memory of 660 2248 systray.exe 41 PID 2248 wrote to memory of 660 2248 systray.exe 41
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe"C:\Users\Admin\AppData\Local\Temp\9c54fcbb8be190c5e9d17100f4c3ad49f8d3427608121d1a86b6402a98fd61daN.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cQWGiu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp477C.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2756
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2592
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2612
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2628
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2648
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2672
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2040
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:660
-
-